Dota 2 Mod Manager

[!WARNING] Copies of this app are going around. Renamed builds of Dota 2 Mod Manager are handed out and sold as other people's launchers, with no source code and no credit. The real one is free, has no paid version and never asks for your Steam login. Do not trust a launcher that shows no source code, names nobody it is built on, wants a subscription or a payment, or makes you sign in. Get it only from dota2modmanager.com or this repository's releases. How to tell the real one.

[!NOTE] Not affiliated with Valve. Every mod here is client-side: nobody else sees them, and no other player's game is touched. Safe mode is on by default and keeps the app out of Dota's own files entirely; the one feature that changes them asks first and reverts byte for byte.

Why not just copy the files yourself? You can, and people do. What the app adds is everything after that: switching a mod off before a match without deleting it, a weather effect or a courier your account never bought drawn on your own screen, a setup you send as one link, and a game that still works after a Dota patch.

What it does

Make your own mods with AI

The repository carries a skill for AI coding assistants: everything an assistant needs to build a Dota 2 mod from a description. Send this to Claude Code, Codex, Cursor or any agent that can run commands on your computer:

Set up Dota 2 modding for me: https://dota2modmanager.com/ai/setup.md

It clones this repository, installs the skill, checks which tools you have and asks before installing the rest. Then ask for what you want: "make Necrophos' spells blood red", "give me Terrorblade's arcana", "a Ghostface mask and a hooded cloak", "he should pull a knife on spawn". The assistant reads the game's files, compiles with Valve's Workshop Tools, checks the result with the mod doctor and hands you a VPK to drag into the app.

In Claude Code it also installs as a plugin:

/plugin marketplace add dota2modmanager/dota2-mod-manager
/plugin install dota2-modding@dota2modmanager

The skill lives in skills/dota2-modding: SKILL.md, references for each kind of mod, helper scripts for Blender and Python, and the npm run modkit commands it drives. We wrote it down while building a full custom Necrophos set this way. The guide for people: Make Dota 2 mods with AI.

Install

1. Download Dota 2 Mod Manager Setup — direct link, always the latest version
2. Run it. The app installs, creates a shortcut and starts
3. It finds Dota on its own. No launch options, no Steam properties to edit

On Linux the same app ships as an AppImage: chmod +x it and run it.

[!IMPORTANT] Windows will call the publisher unknown, because the installer carries no paid signature. Click More info, then Run anyway. Every release is built from this source by a public workflow rather than uploaded from anybody's desktop, and the build log for the exact file you downloaded is open to read.

Every file on a release is listed with its SHA-256 in SHA256SUMS, and the release workflow signs that list through Sigstore. To check that a download came out of that workflow, with the GitHub CLI:

gh attestation verify Dota-2-Mod-Manager-Setup.exe --repo dota2modmanager/dota2-mod-manager

Or against the list alone, in a folder holding both files:

sha256sum --check --ignore-missing SHA256SUMS

On Windows without the GitHub CLI, Get-FileHash Dota-2-Mod-Manager-Setup.exe in PowerShell prints the hash to compare with its line in SHA256SUMS. Releases published before this check existed have no SHA256SUMS.

How it works

Nothing is injected into Dota's process, and no file of the game is opened while it runs.

• Dota mounts one folder, named after its voice language. The app sets that language in the game's own settings and installs there — no launch option involved, which is the part worth reading twice. Why that works
• VPK mods go in as pakNN_dir.vpk. Trees, river, shaders, hero effects and the other categories that must load first get pak02 to pak29; everything else starts at pak30. pak64 is the app's own notice text, and pak65 to pak67 are left to Minify. Slots and load order
• Switching a mod off renames its file to .off. The game skips it, the file stays
• Fonts and cursors go into the game's own folders, with the originals backed up first
• Everything that writes to the game folder is one transaction: if a step fails, the whole change rolls back, displaced files included
• Safe mode, on by default, means the app never touches Dota's own files. Turning it off adds one line to gameinfo_branchspecific.gi and a signature to dota.signatures — both backed up before the first edit, both restored byte for byte when it goes back on. What that buys and costs
• After a Dota update the app checks its own work. If Valve changed the search paths that line is copied from, it writes the line again. It also compares the game files your mods replace with the new build, and a mod whose files the update changed gets a pre-patch mark in My mods: if something in the game looks wrong after a patch, that is where to look first

Downloads live in %APPDATA%/dota2-mod-manager/downloads, the install manifest beside them. The full picture is in ARCHITECTURE.md, and every module is listed in docs/API.md, which is generated from the source rather than written.

Alongside Dota2 Minify

Dota2 Minify is a different kind of tool by a different author: it builds mods by patching the game where this installs finished ones from a catalog. Run both. This app installs into whichever folder the game will really mount — including the one Minify picked — never hands out the pak slots Minify writes, and leaves its files alone. Minify since v1.14rc7 checks ownership before clearing the map folder, so a terrain installed here survives its uninstall.

What Minify is, and how the two share a game.

Documentation

Installing mods	The whole route, by hand and with the app
The language folder	Why -language is not needed, and what it does when it is there
VPK and load order	Pak slots, which mod wins, and gameinfo.gi
Safe mode	What the app writes into the game, and what it does not
Free cosmetics	The item table, and what it can and cannot give you
After a Dota patch	What breaks, and what the app puts back
Make mods with AI · skills/dota2-modding · docs/item-mods.md	The skill an assistant builds mods with, and how an item mod is built from the game's files
Every fact, checkable	Version, platforms, counts, and how to verify each one
ARCHITECTURE.md · docs/API.md

Report a problem

Bug report	Something is broken. Settings → Diagnostics → Export report puts everything needed in one file
Feature request	An idea for how the app should work
Discussions	Questions, setups worth showing, and anything that is not yet a bug
Discord	Quick help in the Mod Manager post under #utilities on the D2PFX catalog's server, and new versions in #mod-manager. The maintainer is there as Fleece, with the Dota 2 Mod Manager Dev role and this GitHub account linked on the profile. The server's widget lists who is online, no account needed
Security	Vulnerabilities, privately — never a public issue
[email protected]	Anything that does not fit a public tracker: press, licensing, a company asking questions

Two things first: make sure you are on the latest version, and if Dota updated recently, open the app and let it put the patch back.

Project activity

Drawn from this repository's own git log when the site rebuilds, which it does daily and after every release. No third-party widget, so nobody reading this page is loading a tracker, and nothing has to be committed for the picture to move.

What runs on every push:

Tests	eslint first, then the full suite with a coverage floor, on Linux and on Windows. Several of the tests hold the project against itself rather than testing a module: every IPC channel has a handler and every handler runs, every renderer import resolves, every Russian string has an English twin, the version and both changelogs agree, docs/API.md still matches the source, and DECISIONS.md still matches the repository
CodeQL	Security and quality analysis, plus a weekly scheduled run
Linux	Builds the AppImage, starts the app against the sandbox, photographs the first window and reads the log for code that could not run
Window	On Linux and on Windows: installs a mod, switches it off and on and removes it by clicking in the window, checking the game folder on disk after each launch. Offline, with a fixture catalog
Release	On a tag only: builds the Windows installer, the portable build and the Linux AppImage from that commit into a draft release, installs the installer and the AppImage from the draft and clicks a mod through each, and publishes the release with its changelog section only when both pass
Site	Rebuilds the documentation site so its counts, its version and this card stay true. On a pull request it only builds the site and checks the output
Mirror	Pushes the same history to , so the code outlives this repository

Nothing here commits back to main. Workflows that need to remember something between runs keep it in the Actions cache, or, for the weekly report, at the end of its own comment, because a bot commit per run is how a log stops being readable.

Development

npm install
npm start                 # run the app
npm test                  # the whole suite, no framework, no mocks library
npm run test:coverage     # the same with the floor CI enforces
npm run docs              # regenerate docs/API.md from src/
npm run sandbox:seed      # a throwaway game tree with real mods in it
npm run start:sandbox     # the app against it, never your own game
npm run dota:diff         # what changed between two Dota builds (6944 6952, or the last two)

Node 24, Electron 45. The main process is TypeScript that Node runs without a build, and the window is TypeScript and React, built by Vite. Every release is produced by release.yml from the commit its tag names.

Open an issue before building anything larger than a fix. It costs one message and saves the case where two people solve the same thing twice, or where the answer was "that is deliberate, and here is why". CONTRIBUTING.md has the rest; AGENTS.md is the same ground for anyone working with a coding assistant.

Written with Claude Code

This project has been written with Claude Code since its first commit on 20 July 2026, and still is. Commits carry a Co-Authored-By trailer saying so.

It says so here because guessing is worse. Everything that would tell you whether the code is any good is already in the open: every commit, more than forty test files, a linter and a coverage floor that CI enforces on two operating systems, and DECISIONS.md, which answers the questions reviewers keep asking with a command you can run yourself.

Send a change written with an assistant and keep the trailer on it. AGENTS.md is what the project asks for in return.

What it is built on

Everything third-party the app ships or fetches, and the one outside source this repository's checks read, with the licence each comes under. The NOTICE file has the full text and the two additional terms this project adds under section 7 of the GPL.

	What for	Licence
Electron	The window and the process behind it	MIT
electron-updater	Update checks and installing them	MIT
adm-zip	Reading mod archives, behind our own size and path guards	MIT
React	The window's screens, compiled into its page	MIT
Motion	How the window's screens move, compiled into its page	MIT
Source 2 Viewer	Decoding Dota's own textures for item icons. Downloaded on demand, never bundled	MIT
Inter, Exo 2, Material Symbols	The typefaces and icons, shipped inside the app rather than fetched	OFL-1.1, Apache-2.0
Astro	The documentation site, not the app	MIT
GameTracking-Dota2	Every Dota build as text, read by this repository's checks to report what an update changed. Not the app	None stated. Read over the network; nothing from it is copied here

package.json lists 16: adm-zip, electron-updater and undici ship inside the app, motion, react and react-dom are built into its window, @types/react, @types/react-dom, @vitejs/plugin-react, axe-core, electron, electron-builder, eslint, fast-check, typescript and vite only build or check it.

The tests use no dependencies at all, and tools/ uses one, vite, to build the window. The VPK reader and writer, the KeyValues parser, the zip guards and the update logic are written here, because every dependency is a stranger with write access to a game folder on tens of thousands of machines.

Valve's own vpk.exe is deliberately not here and must not be added: it is proprietary, and a project that bundles it is not open source in the sense SignPath's terms mean. Reading and writing VPK archives is done by this repository's own code, which is why src/vpk.ts exists.

Credits

• All mods, previews, guides and catalog data come from the open-source D2PFX repository by h6rd and the Dota 2 modding community. This app is a desktop client for their catalog, and every mod card in it credits its author.
• Community tools (VPKMerge, Background Changer, Compiler, ItemsFix) belong to their authors.
• J0nathan550 brought the arcanas into the item builder, played every one of them through it, and compiled again by hand the ones Valve's files break there, so Razor runs forward and Juggernaut keeps all his animations. The fixed arcanas live in d2pfx-arcana-fixes, and the app downloads them from there.
• Dota's updates are read from GameTracking-Dota2 by SteamTracking, which commits every Dota build as text within the hour. The Dota updates issue, the report on each new build, is built on it.
• hanta filmed a walkthrough in Russian, which answers more questions than this page does for anyone who would rather watch than read.

Every other page that links here, from the catalog's README to the projects built from this code, is listed with dates in MENTIONS.md. The few the maintainer wrote are in a list of their own.

Sponsors

Sponsored by VGTopup, a game top-up store. Paid placement.

License

GPL-3.0. Copyright (C) 2026 TheFleece.

Fork it, change it, ship your own. GPL-3.0 asks you to keep the copyright line, to say that you changed the code and when, and to open your version under the same license. Section 7 lets an author add two more, and this repository does: keep the credit the app shows, and pick your own name for your version. NOTICE puts all of it in plain words.

Catalog content belongs to h6rd and the mod authors, under the license in their repository.